Win7 Ultimtate 64bit; nach Bundespolizei-Virus; kein Rechtsklick; nichts installierbar; Speicher auf Festplatte immer voll

TrisxG · 01.03.2014, 11:42

Hallihallo ihr Allwissenden,
ich habe vor 2-3 Jahren ca. bei meinem alten Laptop den Bundespolizei Virus entfernt. Da ich zu den Unwissenden gehöre hat das nur bedingt funktioniert. Allerdings war dieser Laptop schon so alt, dass ich mich nach einiger Zeit des kläglichen Versagens von ihm getrennt habe, was auch daran liegen könnte, dass meine Eltern mir damals einen neuen geschenkt haben. Nun brauche ich ihn für die Uni wieder und stehe vor folgenden Problemen:
1. Wenn ich auf dem Desktop und dem Explorer einen Rechtsklick mache öffnet sich kein Pop-Up
2. Egal, wie viel Speicher freigemacht wird auf dem C Laufwerk, der Speicher ist nach kurzer Zeit wieder voll.
3. Ich kann keinerlei Programme installieren, da dann immer die Fehlermeldung kommt, das Programm sei keine zulässige win32-Anwendung.
Das ist auch der Grund, warum ich keine Logfiles erstellen kann, da ich Malewarebytes nicht installieren kann.

Zum System: Windows 7 Ultimate 64bit

Ich weiß leider nicht mehr, mit welcher Art von "Hilfe-CD" ich den Virus entfernt habe.

Falls irgendwas fehlt oder ich bei der Fragestellung einen Fehler gemacht habe, tut es mir leid dies ist mein erster Beitrag und ich habe versucht mich an alle Regeln zu halten

!

Schon mal RIESEN Dank im voraus,
Tristan

PS: Bin was Computerfachwissen angeht etwas zurückgeblieben und wäre sehr dankbar wenn alle Schritte im kleinsten erklärt sind, sonst verstehe ich sie wahrscheinlich nicht.

schrauber · 01.03.2014, 11:56

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

TrisxG · 01.03.2014, 12:04

Danke schonmal,
aber wie ich schon sagte kann ich keinerlei Programme installieren.
Habe beide Versionen runtergeladen und bei beiden Versionen kam die Fehlermeldung:
Keine zulässige Win32-Anwendung.

Tristan

schrauber · 02.03.2014, 08:00

Mach das bitte vorher, dann nochmal FRST versuchen.

Suchlauf mit rKill

Bitte lade dir rKill von Grinler auf deinen Desktop von einem der folgenden Links: RKill oder http://www.trojaner-board.de/85629-rkill-download.html

Starte nun das Programm durch einen Doppelklick.
Wenn sich jetzt kein schwarzes Fenster öffnet, dann versuche einen der anderen Downloadlinks.
Das Tool wird jetzt einige Minuten lang laufen und verschiedene Einstellungen prüfen und neu setzen.
Nach dem Ende der Abarbeitung öffnet sich automatisch die Logdatei rkill.txt.
Bitte poste sie in deinen Thread in CODE-Tags (Anleitung).

TrisxG · 05.01.2015, 20:16

Besser spät als nie

Code:

ATTFilter

Rkill 2.6.9 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
 hxxp://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/05/2015 08:08:50 PM in x64 mode.
Windows Version: Windows 7 Ultimate 

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * ALERT: ZEROACCESS rootkit symptoms found!

     * C:\Windows\assembly\GAC_32\Desktop.ini [ZA File]
     * C:\Windows\assembly\GAC_64\Desktop.ini [ZA File]

Und jetzt von FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2015
Ran by PeterLustig (administrator) on PETERLUSTIG-PC on 05-01-2015 20:12:57
Running from C:\Users\PeterLustig\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FQDD3I0Q
Loaded Profile: PeterLustig (Available profiles: PeterLustig)
Platform: Windows 7 Ultimate (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Eugene Roshal & FAR Group) C:\Windows\Fonts\AXG0Q5~1.COM
(Eugene Roshal & FAR Group) C:\Windows\Fonts\aXG0Q5j0.com


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [1996200 2012-06-27] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoViewContextMenu] 1
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\MountPoints2: {975ae626-0a9f-11e1-a54f-001742ebcb24} - F:\LaunchU3.exe -a
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\MountPoints2: {dc97fd66-c321-11e3-bb4b-001742ebcb24} - E:\Madden08.exe
HKU\S-1-5-18\...\Run: [kfbuvpzrsuypcoh] => C:\ProgramData\kfbuvpzr.exe
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe [353440 2012-04-02] (Adobe Systems Incorporated)
SubSystems: [Windows] ATTENTION! ====> ZeroAccess
AlternateShell: C:\Windows\Temp\cgltdt\setup.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qAkXaMzouyCqopHDHEHnWMteu03oQ6tq7mMGDgDyyDhG3jikjLW31FmqA5Inz0Lt5hJFbnGkbMy8ztEJH8OoDs0TPT_hJA-CeY,
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1814202685-1767394472-907846378-1001 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1814202685-1767394472-907846378-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
BHO: SmartbarInternetExplorerBHOEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: SmartbarInternetExplorerBHOEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: CescrtHlpr Object -> {64182481-4F71-486b-A045-B233BD0DA8FC} -> C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 02 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 01 mswsock.dll File Not found ()
Winsock: Catalog9 02 mswsock.dll File Not found ()
Winsock: Catalog9 03 mswsock.dll File Not found ()
Winsock: Catalog9 04 mswsock.dll File Not found ()
Winsock: Catalog9 05 mswsock.dll File Not found ()
Winsock: Catalog9 06 mswsock.dll File Not found ()
Winsock: Catalog9 07 mswsock.dll File Not found ()
Winsock: Catalog9 08 mswsock.dll File Not found ()
Winsock: Catalog9 09 mswsock.dll File Not found ()
Winsock: Catalog9 10 mswsock.dll File Not found ()
Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 02 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9-x64 01 mswsock.dll File Not found ()
Winsock: Catalog9-x64 02 mswsock.dll File Not found ()
Winsock: Catalog9-x64 03 mswsock.dll File Not found ()
Winsock: Catalog9-x64 04 mswsock.dll File Not found ()
Winsock: Catalog9-x64 05 mswsock.dll File Not found ()
Winsock: Catalog9-x64 06 mswsock.dll File Not found ()
Winsock: Catalog9-x64 07 mswsock.dll File Not found ()
Winsock: Catalog9-x64 08 mswsock.dll File Not found ()
Winsock: Catalog9-x64 09 mswsock.dll File Not found ()
Winsock: Catalog9-x64 10 mswsock.dll File Not found ()
Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @thrixxx.com/WebLaunch -> C:\Program Files (x86)\thriXXX\WebLaunch\Binaries\npWebLaunch.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1814202685-1767394472-907846378-1001: @thrixxx.com/WebLaunch -> C:\Program Files (x86)\thriXXX\WebLaunch\Binaries\npWebLaunch.dll No File

Chrome: 
=======
CHR HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\PeterLustig\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-17]
CHR HKLM-x32\...\Chrome\Extension: [ihflimipbcaljfnojhhknppphnnciiif] - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx [2011-09-05]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [36632 2014-03-25] () <==== ATTENTION
S4 adobeversioncue; %systemroot%\system32\unrealircd.dll [X]
S4 atinevxx; %systemroot%\system32\SenFiltService.dll [X]
S4 xfactorae1; %systemroot%\system32\arhidfltr.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-14] (Disc Soft Ltd)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

NETSVC: {6080a529-897e-4629-a488-aba0c29b635e} -> No ServiceDLL Path.
NETSVC: adobeversioncue -> C:\Windows\system32\unrealircd.dll ==> No File.
NETSVC: atinevxx -> C:\Windows\system32\SenFiltService.dll ==> No File.
NETSVC: xfactorae1 -> C:\Windows\system32\arhidfltr.dll ==> No File.

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-05 20:12 - 2015-01-05 20:13 - 00000000 ____D () C:\FRST
2015-01-05 20:00 - 2015-01-05 20:09 - 00001712 _____ () C:\Users\PeterLustig\Desktop\Rkill.txt
2015-01-05 19:50 - 2015-01-05 19:50 - 00244264 _____ () C:\Users\PeterLustig\Downloads\Firefox Setup Stub 34_0_5_exe
2015-01-05 19:40 - 2015-01-05 19:48 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-05 19:40 - 2015-01-05 19:45 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-05 19:40 - 2015-01-05 19:45 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-05 19:40 - 2015-01-05 19:40 - 00004116 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-05 19:40 - 2015-01-05 19:40 - 00003864 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-05 19:40 - 2015-01-05 19:40 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Google
2015-01-05 19:36 - 2015-01-05 19:48 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Deployment
2015-01-05 19:36 - 2015-01-05 19:36 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Apps\2.0
2014-12-28 18:35 - 2014-12-28 18:35 - 00108840 _____ () C:\Users\PeterLustig\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-28 18:34 - 2015-01-05 15:41 - 00000146 _____ () C:\Windows\setupact.log
2014-12-28 18:34 - 2014-12-28 18:34 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-28 18:33 - 2014-12-28 18:34 - 00415624 _____ () C:\Windows\system32\FNTCACHE.DAT

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-05 20:12 - 2011-10-15 14:33 - 01514421 _____ () C:\Windows\WindowsUpdate.log
2015-01-05 19:57 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At40.job
2015-01-05 19:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At39.job
2015-01-05 18:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At38.job
2015-01-05 18:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At37.job
2015-01-05 17:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At36.job
2015-01-05 17:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At35.job
2015-01-05 16:58 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At34.job
2015-01-05 16:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At33.job
2015-01-05 15:57 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At32.job
2015-01-05 15:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At31.job
2015-01-05 15:27 - 2009-07-14 05:45 - 00016624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-05 15:27 - 2009-07-14 05:45 - 00016624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-05 15:19 - 2011-11-14 17:11 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\LogMeIn Hamachi
2015-01-05 15:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-03 08:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At18.job
2015-01-03 08:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At17.job
2015-01-03 07:57 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At16.job
2015-01-03 07:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At15.job
2015-01-03 06:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At14.job
2015-01-03 06:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At13.job
2015-01-03 05:57 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At12.job
2015-01-03 05:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At11.job
2015-01-03 04:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At10.job
2015-01-03 04:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At9.job
2015-01-03 03:57 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At8.job
2015-01-03 03:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At7.job
2015-01-03 02:57 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At6.job
2015-01-03 02:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At5.job
2015-01-03 01:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At4.job
2015-01-03 01:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At3.job
2015-01-03 00:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At2.job
2015-01-03 00:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At1.job
2015-01-02 23:57 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At48.job
2015-01-02 23:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At47.job
2015-01-02 23:41 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At46.job
2015-01-02 23:41 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At44.job
2015-01-02 23:41 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At42.job
2015-01-02 23:41 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At30.job
2015-01-02 23:41 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At28.job
2015-01-02 23:41 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At26.job
2015-01-02 23:41 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At24.job
2015-01-02 23:41 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At22.job
2015-01-02 23:41 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At20.job
2015-01-02 23:39 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At45.job
2015-01-02 23:39 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At43.job
2015-01-02 23:39 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At41.job
2015-01-02 23:39 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At29.job
2015-01-02 23:39 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At27.job
2015-01-02 23:39 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At25.job
2015-01-02 23:39 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At23.job
2015-01-02 23:39 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At21.job
2015-01-02 23:39 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At19.job

ZeroAccess:
C:\Windows\System32\consrv.dll

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

Files to move or delete:
====================
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At10.job
C:\Windows\Tasks\At11.job
C:\Windows\Tasks\At12.job
C:\Windows\Tasks\At13.job
C:\Windows\Tasks\At14.job
C:\Windows\Tasks\At15.job
C:\Windows\Tasks\At16.job
C:\Windows\Tasks\At17.job
C:\Windows\Tasks\At18.job
C:\Windows\Tasks\At19.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At20.job
C:\Windows\Tasks\At21.job
C:\Windows\Tasks\At22.job
C:\Windows\Tasks\At23.job
C:\Windows\Tasks\At24.job
C:\Windows\Tasks\At25.job
C:\Windows\Tasks\At26.job
C:\Windows\Tasks\At27.job
C:\Windows\Tasks\At28.job
C:\Windows\Tasks\At29.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At30.job
C:\Windows\Tasks\At31.job
C:\Windows\Tasks\At32.job
C:\Windows\Tasks\At33.job
C:\Windows\Tasks\At34.job
C:\Windows\Tasks\At35.job
C:\Windows\Tasks\At36.job
C:\Windows\Tasks\At37.job
C:\Windows\Tasks\At38.job
C:\Windows\Tasks\At39.job
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At40.job
C:\Windows\Tasks\At41.job
C:\Windows\Tasks\At42.job
C:\Windows\Tasks\At43.job
C:\Windows\Tasks\At44.job
C:\Windows\Tasks\At45.job
C:\Windows\Tasks\At46.job
C:\Windows\Tasks\At47.job
C:\Windows\Tasks\At48.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job
C:\Windows\Tasks\At9.job


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
ATTENTION: ====> ZeroAccess. Use DeleteJunctionsIndirectory: C:\Windows\system64


LastRegBack: 2014-01-06 22:48

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-01-2015
Ran by PeterLustig at 2015-01-05 20:14:16
Running from C:\Users\PeterLustig\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FQDD3I0Q
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.2.202.228 - Adobe Systems Incorporated)
Adobe Reader X (10.1.2) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.2 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
BlackBerry Desktop Software 6.1 (HKLM-x32\...\BlackBerry_Desktop) (Version: 6.1.0.33 - Research in Motion Ltd.)
BlackBerry Desktop Software 6.1 (x32 Version: 6.1.0.33 - Research in Motion Ltd.) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.17 - Piriform)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Facemoods Toolbar (HKLM-x32\...\facemoods) (Version:  - ) <==== ATTENTION
FLV Player 2.0 (build 25) (HKLM-x32\...\FLV Player) (Version: 2.0 (build 25) - Martijn de Visser)
Fragen-Lern-CD 4.1 (HKLM-x32\...\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1) (Version: 4.1.0 - Wendel-Verlag GmbH)
Fragen-Lern-CD 4.1 (x32 Version: 4.1.0 - Wendel-Verlag GmbH) Hidden
Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2413 - Intel Corporation)
Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216029FF}) (Version: 6.0.290 - Oracle)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.1.0.210 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.1.0.210 - LogMeIn, Inc.) Hidden
LPT System Updater Service (x32 Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION
Madden NFL 08 (HKLM-x32\...\{A3BC1DBD-64D6-4EBC-0091-24C811662D40}) (Version:  - Electronic Arts)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.6361.0 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.6361.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
PlanetSide 2 (HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\SOE-PlanetSide 2 PSG) (Version: 1.0.3.183 - Sony Online Entertainment)
PokerStars.net (HKLM-x32\...\PokerStars.net) (Version:  - PokerStars.net)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.12 - ProtectDisc Software GmbH)
Sharepod 4.0.1.1 (HKLM-x32\...\{085BCFB8-F6FB-4600-AFAB-1F6DBC7F5F99}_is1) (Version:  - Macroplant LLC)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
System Requirements Lab for Intel (HKLM-x32\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
WinRAR 5.10 beta 2 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.10.2 - win.rar GmbH)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
Yahoo Community Smartbar (HKLM-x32\...\{D96EBFC0-C680-4463-B4F0-299E48771819}) (Version: 11.38.66.16134 - Linkury Inc.) <==== ATTENTION
Yahoo Community Smartbar Engine (HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\{c45e78d7-8eca-402f-84b1-aa063a22758d}) (Version: 11.38.66.16134 - Linkury Inc.) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {023CD47E-D530-4FC7-9E63-D52218A94836} - System32\Tasks\At27 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {038512EA-790D-4E62-9CA5-71832688CC9E} - System32\Tasks\At34 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {08A060D2-79C5-493C-BB58-F25C6BA42274} - System32\Tasks\At16 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {08A9CDCF-140F-4946-A22B-E96942BE57D2} - System32\Tasks\At23 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {0EBCB69F-9D95-4F02-8874-8B54A76C1BF9} - System32\Tasks\At28 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {2250FD76-06B7-4D19-8C28-5B0474A7E0DD} - System32\Tasks\At41 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {27C900CA-85F1-4FF4-BF0E-0F224CDCEE5A} - System32\Tasks\At31 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {2E82F8AA-E085-4430-A9BB-E07E6770A077} - System32\Tasks\At43 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {31B133A7-6BF9-4DBC-AB99-6B8925F5678E} - System32\Tasks\At19 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {31E98F7C-57A5-44C6-BDD5-2295CE741066} - System32\Tasks\At11 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {4078CE44-2A79-4173-A0A8-0EF2F3727E8E} - System32\Tasks\At39 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {4287194E-8E3C-4B92-85DA-262E7B651873} - System32\Tasks\At25 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {472C7580-D297-44A5-8EE3-43D947010E8F} - System32\Tasks\At46 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {481CA121-F260-48A8-AB9F-8207906D6669} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02] (Adobe Systems Incorporated)
Task: {4D32C843-60B5-4524-928D-C6046D3D086B} - System32\Tasks\{050359C3-9664-4B7F-981F-22EB0E99C906} => D:\Modern Warfare 2\iw4sp.exe [2009-11-10] ()
Task: {509EFCB0-06DF-405A-B8D9-BE8252DA49B9} - System32\Tasks\At18 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {5369728C-FA0A-4D9B-9A4D-898B7C8E8465} - System32\Tasks\At3 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {53DC4EDD-B197-47BE-9D1A-F41F01A80888} - System32\Tasks\At1 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {5457AB80-34BF-42D3-87A8-2B3D00DC132B} - System32\Tasks\At22 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {569F5BA8-93C1-49AD-B818-C2CB24760FA7} - System32\Tasks\{7E3D0B0F-9677-418A-ABB0-411EAF0FB4AB} => D:\Modern Warfare 2\iw4sp.exe [2009-11-10] ()
Task: {599793EA-CD10-48C5-8721-98EE9D23E16A} - System32\Tasks\At8 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {5E38C7E8-E2C0-4D69-B413-4B736CD92CCC} - System32\Tasks\At9 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {62924DAD-B30D-429A-ADB2-E506CB9C60DA} - System32\Tasks\At29 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {6753B9B6-7291-4A5B-B8DB-E7B1BAAEEDD9} - System32\Tasks\At7 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {6BFB77DE-9F9A-4062-8E58-473F4DFCE9F3} - System32\Tasks\At35 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {71BA5A7F-5E29-4BEF-BF7E-53BD12347730} - System32\Tasks\At15 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {72A13C74-F5DD-4993-A479-FBD21EEEC63A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-05] (Google Inc.)
Task: {74909335-1F09-4813-9CB5-9F50961B6C50} - System32\Tasks\At33 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {7DFA7A51-CB8E-4C09-A88E-5075F41AE38A} - System32\Tasks\At10 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {7FEE53C9-2AC5-4715-A32B-7E7BE3735F8F} - System32\Tasks\At12 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {855EC2F5-2255-4EE3-8531-F915AEB0DE37} - System32\Tasks\At13 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {8703EFC1-6D0E-4723-9258-093671AC0128} - System32\Tasks\At26 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {888ED9C2-7590-4DA1-81C7-671F71B1C538} - System32\Tasks\At17 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {89955AE0-5426-442E-9F25-CE20C3CF8A77} - System32\Tasks\At38 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {8F366998-5120-47A1-B751-07B0D0453A53} - System32\Tasks\At24 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {92D5906E-6D2E-4935-95B2-9030563C4832} - System32\Tasks\At44 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {94F8A3A4-E096-402F-914D-84C77235BABE} - System32\Tasks\At45 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {9E0C44A3-F6B6-47CD-9733-A3521CF30278} - System32\Tasks\At20 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {A1338183-DA0E-493E-ABE4-9B7E7D35B232} - System32\Tasks\{966132B3-2041-49F5-957E-2D3FF4AFE000} => pcalua.exe -a C:\Mathe\Geogebra\GeoGebra.exe -d C:\Mathe\Geogebra
Task: {A770A8E0-BF77-471E-A909-7B38FCA68351} - System32\Tasks\At5 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {A87E06E5-FD8F-4074-B5B8-8D3317F4B095} - System32\Tasks\At4 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {AD5DD74D-2807-4D4B-8070-44BA7CD3B177} - System32\Tasks\At37 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {B0B9403C-2698-4423-AC14-A5278F2F582D} - System32\Tasks\At14 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {B733B431-E348-4B31-90FB-67C560102E4C} - System32\Tasks\At6 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {BF53F786-18A4-44C7-ABA0-8F4D67BD05FF} - System32\Tasks\At2 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {C39A241F-7AA3-4C1C-B50F-FCFB1AC29A2B} - System32\Tasks\At40 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {C55919B0-0C58-452F-B2E8-3B7875AA23EA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-05] (Google Inc.)
Task: {C8B3DBE1-B577-4E80-BA3D-0B63C7CEEFA7} - System32\Tasks\At32 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {C9E77C31-3B2C-4C80-8007-BF9F5BF919FF} - System32\Tasks\At48 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {CF1FEFCC-5EBC-4306-BE09-0FEA2DBA812A} - System32\Tasks\At30 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {D3C0EEF8-371C-4804-BC98-0EC69D0B5F9D} - System32\Tasks\At42 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {E4C73F13-5D9C-4CBF-B9BD-4243F3568776} - System32\Tasks\At47 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {E4E70D88-095F-4A38-920F-E76EAEAE7F0E} - System32\Tasks\At21 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: {FF26CF92-C490-457D-B019-EC9DB864B1D1} - System32\Tasks\At36 => C:\Windows\Fonts\aXG0Q5j0.com [2012-04-02] (Eugene Roshal & FAR Group) <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\At1.job => ?
Task: C:\Windows\Tasks\At10.job => ?
Task: C:\Windows\Tasks\At11.job => ?
Task: C:\Windows\Tasks\At12.job => ?
Task: C:\Windows\Tasks\At13.job => ?
Task: C:\Windows\Tasks\At14.job => ?
Task: C:\Windows\Tasks\At15.job => ?
Task: C:\Windows\Tasks\At16.job => ?
Task: C:\Windows\Tasks\At17.job => ?
Task: C:\Windows\Tasks\At18.job => ?
Task: C:\Windows\Tasks\At19.job => ?
Task: C:\Windows\Tasks\At2.job => ?
Task: C:\Windows\Tasks\At20.job => ?
Task: C:\Windows\Tasks\At21.job => ?
Task: C:\Windows\Tasks\At22.job => ?
Task: C:\Windows\Tasks\At23.job => ?
Task: C:\Windows\Tasks\At24.job => ?
Task: C:\Windows\Tasks\At25.job => ?
Task: C:\Windows\Tasks\At26.job => ?
Task: C:\Windows\Tasks\At27.job => ?
Task: C:\Windows\Tasks\At28.job => ?
Task: C:\Windows\Tasks\At29.job => ?
Task: C:\Windows\Tasks\At3.job => ?
Task: C:\Windows\Tasks\At30.job => ?
Task: C:\Windows\Tasks\At31.job => ?
Task: C:\Windows\Tasks\At32.job => ?
Task: C:\Windows\Tasks\At33.job => ?
Task: C:\Windows\Tasks\At34.job => ?
Task: C:\Windows\Tasks\At35.job => ?
Task: C:\Windows\Tasks\At36.job => ?
Task: C:\Windows\Tasks\At37.job => ?
Task: C:\Windows\Tasks\At38.job => ?
Task: C:\Windows\Tasks\At39.job => ?
Task: C:\Windows\Tasks\At4.job => ?
Task: C:\Windows\Tasks\At40.job => ?
Task: C:\Windows\Tasks\At41.job => ?
Task: C:\Windows\Tasks\At42.job => ?
Task: C:\Windows\Tasks\At43.job => ?
Task: C:\Windows\Tasks\At44.job => ?
Task: C:\Windows\Tasks\At45.job => ?
Task: C:\Windows\Tasks\At46.job => ?
Task: C:\Windows\Tasks\At47.job => ?
Task: C:\Windows\Tasks\At48.job => ?
Task: C:\Windows\Tasks\At5.job => ?
Task: C:\Windows\Tasks\At6.job => ?
Task: C:\Windows\Tasks\At7.job => ?
Task: C:\Windows\Tasks\At8.job => ?
Task: C:\Windows\Tasks\At9.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-07-14 00:21 - 2009-07-14 02:41 - 00320000 _____ () C:\Windows\system32\mswsock.dll
2014-03-25 07:54 - 2014-03-25 07:54 - 00148248 _____ () C:\Users\PeterLustig\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll
2012-05-30 19:06 - 2012-05-30 19:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 19:06 - 2012-05-30 19:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot => "AlternateShell"="C:\Windows\Temp\cgltdt\setup.exe"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\PeterLustig\AppData\Local\Smartbar\Application\Smartbar.exe startup
MSCONFIG\startupreg: facemoods => "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RIMBBLaunchAgent.exe => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-1814202685-1767394472-907846378-500 - Administrator - Disabled)
Gast (S-1-5-21-1814202685-1767394472-907846378-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1814202685-1767394472-907846378-1004 - Limited - Enabled)
PeterLustig (S-1-5-21-1814202685-1767394472-907846378-1001 - Administrator - Enabled) => C:\Users\PeterLustig

==================== Faulty Device Manager Devices =============

Name: Massenspeichercontroller
Description: Massenspeichercontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: O2Micro SmartCardBus_Reader
Description: O2Micro SmartCardBus_Reader
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft-6zu4-Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-ISATAP-Adapter
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-ISATAP-Adapter #2
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-ISATAP-Adapter #3
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-ISATAP-Adapter #4
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/05/2015 07:45:04 PM) (Source: MsiInstaller) (EventID: 11704) (User: NT-AUTORITÄT)
Description: Product: Google Update Helper -- Error 1704. An installation for Microsoft .NET Framework 4 Client Profile is currently suspended.  You must undo the changes made by that installation to continue.  Do you want to undo those changes?

Error: (01/05/2015 07:37:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung Fehler in der Wiederherstellungsphase. beendet.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Gatherer wird heruntergefahren.  (HRESULT : 0x80040d23) (0x80040d23)

Error: (01/05/2015 07:37:54 PM) (Source: Windows Search Service) (EventID: 3602) (User: )
Description: Fehler-ID 1 in der Wiederherstellungsphase von Windows Search. Bitte starten Sie den Dienst erneut. Wenn dieser Fehler weiterhin besteht, führen Sie eine Neuerstellung des Index aus.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Gatherer wird heruntergefahren.  (HRESULT : 0x80040d23) (0x80040d23)

Error: (01/05/2015 07:37:54 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <5, 0x80041828, Fehler beim Hinzufügen des Plug-Ins: Search.TripoliIndexer>.

Error: (01/05/2015 07:37:02 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <5, 0x80041828, Fehler beim Hinzufügen des Plug-Ins: Search.TripoliIndexer>.

Error: (01/05/2015 07:36:49 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x80040d8b, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.

Error: (01/05/2015 07:36:45 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x80040d8b, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.

Error: (01/05/2015 07:33:44 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x80040d8b, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.

Error: (01/05/2015 07:32:01 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x80040d8b, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.

Error: (01/05/2015 07:31:51 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x80040d8b, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.


System errors:
=============
Error: (01/05/2015 08:14:10 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:12:53 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:11:45 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:10:37 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:09:28 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:07:58 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:06:50 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:05:43 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:04:33 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (01/05/2015 08:02:49 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.


Microsoft Office Sessions:
=========================
Error: (01/05/2015 07:45:04 PM) (Source: MsiInstaller) (EventID: 11704) (User: NT-AUTORITÄT)
Description: Product: Google Update Helper -- Error 1704. An installation for Microsoft .NET Framework 4 Client Profile is currently suspended.  You must undo the changes made by that installation to continue.  Do you want to undo those changes?(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (01/05/2015 07:37:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Gatherer wird heruntergefahren.  (HRESULT : 0x80040d23) (0x80040d23)
Fehler in der Wiederherstellungsphase.

Error: (01/05/2015 07:37:54 PM) (Source: Windows Search Service) (EventID: 3602) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Gatherer wird heruntergefahren.  (HRESULT : 0x80040d23) (0x80040d23)
1

Error: (01/05/2015 07:37:54 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 50x80041828Fehler beim Hinzufügen des Plug-Ins: Search.TripoliIndexer

Error: (01/05/2015 07:37:02 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 50x80041828Fehler beim Hinzufügen des Plug-Ins: Search.TripoliIndexer

Error: (01/05/2015 07:36:49 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 40x80040d8bFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects

Error: (01/05/2015 07:36:45 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 40x80040d8bFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects

Error: (01/05/2015 07:33:44 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 40x80040d8bFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects

Error: (01/05/2015 07:32:01 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 40x80040d8bFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects

Error: (01/05/2015 07:31:51 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 40x80040d8bFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 85%
Total physical RAM: 961.88 MB
Available physical RAM: 136.63 MB
Total Pagefile: 3044 MB
Available Pagefile: 1977.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:29.29 GB) (Free:0.01 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:82.49 GB) (Free:45.83 GB) NTFS
Drive e: (MADDEN_NFL_08) (CDROM) (Total:2.11 GB) (Free:0 GB) UDF
Drive f: (TITANIC_PAL_DISC2) (CDROM) (Total:7.47 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 16CCAF43)
Partition 1: (Active) - (Size=29.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=8 MB) - (Type=45)
Partition 3: (Not Active) - (Size=82.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 06.01.2015, 00:43

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Facemoods Toolbar

LPT System Updater Service

Yahoo Community Smartbar

Yahoo Community Smartbar Engine (HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\{c45e78d7-8eca-402f-84b1-aa063a22758d}) (Version: 11.38.66.16134 - Linkury Inc.) <==== ATTENTION
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

TrisxG · 19.01.2015, 21:09

Hallo Schrauber,
danke schonmal für deine Hilfe!
Habe alle Schritte befolgt, allerdings ist ComboFix bei mir mehrere Tage gelaufen, ohne dass ich bewusst irgendetwas getan habe.
Es bleibt bei dem 49.ten Schritt immer stehen, auch bei mehreren Versuchen über mehrere Tage.

Mache ich etwas falsch?
Gruß

schrauber · 20.01.2015, 12:04

Beende Combofix, und poste bitte ein frisches FRST log

TrisxG · 20.01.2015, 13:26

Ich habe ein 64bit System, demnach öffne ich FRST64.
Folgende Fehlermeldung: FRST64.exe ist keine zulässige Win32-Anwendung
Öffne ich FRST für 32bit Systeme zeigt es mir an ich soll FRST64 öffnen.
Gruß,
Tristan

schrauber · 20.01.2015, 18:02

AV Programm abschalten, dann funzt auch FRST

TrisxG · 25.01.2015, 17:04

Ich habe alle Antivirenprogramme abgeschaltet bzw. deinstalliert, allerdings gibt es noch keine Änderung. Ich glaube ich werde den Rechner bald aus dem Fenster werfen

Gruß Tristan

schrauber · 25.01.2015, 19:03

FRST hat doch vorher auch funktioniert. Lass zur Not nochmal RKILL vorher laufen.

TrisxG · 25.01.2015, 20:26

Alles klar, hier ist der rkill log

Code:

ATTFilter

Rkill 2.7.0 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
 hxxp://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/25/2015 08:24:35 PM in x64 mode.
Windows Version: Windows 7 Ultimate 

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\Users\PeterLustig\AppData\Local\LPT\srptm.exe (PID: 4000) [UP-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Defender Disabled

   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001

schrauber · 26.01.2015, 09:56

Ja und dann bitte nochmal direkt nach RKILL FRST versuchen, so meinte ich das eigentlich

TrisxG · 28.01.2015, 19:16

Achso.
ENDLICH hat es funktioniert, dass heißt der Laptop fliegt doch noch nicht aus dem Fenster!
FRST Log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by PeterLustig (administrator) on PETERLUSTIG-PC on 28-01-2015 19:13:07
Running from C:\Users\PeterLustig\Desktop
Loaded Profiles: PeterLustig (Available profiles: PeterLustig)
Platform: Windows 7 Ultimate (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-18\...\Run: [kfbuvpzrsuypcoh] => C:\ProgramData\kfbuvpzr.exe
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe [353440 2012-04-02] (Adobe Systems Incorporated)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1814202685-1767394472-907846378-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qAkXaMzouyCqopHDHEHnWMteu03oQ6tq7mMGDgDyyDhG3jikjLW31FmqA5Inz0Lt5hJFbnGkbMy8ztEJH8OoDs0TPT_hJA-CeY,
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1814202685-1767394472-907846378-1001 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1814202685-1767394472-907846378-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6Xow1K8E36L0X66tJe34f_wLPD5Splg6ZyL_ByCddyIXOg1cJF53aLlcQyUr3Gr7BX1yp3dWfA5n70xSBunLzf9qwzQRFYbWIrx1QAyb-Uuy0CmZBjgY2TdFYHYrlsj_QM7AWuEaULc-33igwTosQPL4_w5LLIg275UwXaUJvlzSTTEetRYQ_IWqU,&q={searchTerms}
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: SmartbarInternetExplorerBHOEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
Winsock: Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"

FireFox:
========
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @thrixxx.com/WebLaunch -> C:\Program Files (x86)\thriXXX\WebLaunch\Binaries\npWebLaunch.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF Plugin HKU\S-1-5-21-1814202685-1767394472-907846378-1001: @thrixxx.com/WebLaunch -> C:\Program Files (x86)\thriXXX\WebLaunch\Binaries\npWebLaunch.dll No File

Chrome: 
=======
CHR HKU\S-1-5-21-1814202685-1767394472-907846378-1001\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\PeterLustig\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S4 adobeversioncue; %systemroot%\system32\unrealircd.dll [X]
S4 atinevxx; %systemroot%\system32\SenFiltService.dll [X]
S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s [X]
S4 xfactorae1; %systemroot%\system32\arhidfltr.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

NETSVC: {6080a529-897e-4629-a488-aba0c29b635e} -> No ServiceDLL Path.
NETSVC: adobeversioncue -> C:\Windows\system32\unrealircd.dll ==> No File.
NETSVC: atinevxx -> C:\Windows\system32\SenFiltService.dll ==> No File.
NETSVC: xfactorae1 -> C:\Windows\system32\arhidfltr.dll ==> No File.

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 19:13 - 2015-01-28 19:14 - 00008680 _____ () C:\Users\PeterLustig\Desktop\FRST.txt
2015-01-28 19:09 - 2015-01-28 19:13 - 00000000 ____D () C:\FRST
2015-01-28 18:49 - 2015-01-28 18:49 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill64-21039.exe
2015-01-27 15:18 - 2015-01-27 15:18 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-01-27 15:13 - 2015-01-27 15:13 - 00108840 _____ () C:\Users\PeterLustig\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-27 14:57 - 2015-01-27 14:57 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill64-21031.exe
2015-01-27 14:49 - 2015-01-27 14:49 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill64-19460.exe
2015-01-27 14:47 - 2015-01-27 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-01-27 14:47 - 2015-01-27 14:47 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2015-01-27 14:45 - 2015-01-28 19:10 - 00000224 _____ () C:\Windows\setupact.log
2015-01-27 14:45 - 2015-01-27 14:46 - 00415624 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-27 14:45 - 2015-01-27 14:45 - 00001746 _____ () C:\Windows\PFRO.log
2015-01-27 14:45 - 2015-01-27 14:45 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-25 22:00 - 2015-01-25 22:00 - 00003118 _____ () C:\Windows\System32\Tasks\{9E93E75A-8F35-42AC-BB63-FB012FA62CC3}
2015-01-25 20:28 - 2015-01-25 20:28 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill64-13113.exe
2015-01-25 20:24 - 2015-01-25 20:24 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill64-12408.exe
2015-01-25 20:21 - 2015-01-25 20:21 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill64.exe
2015-01-25 20:19 - 2015-01-25 20:19 - 01943800 _____ (Bleeping Computer, LLC) C:\Users\PeterLustig\Desktop\rkill.exe
2015-01-25 17:18 - 2015-01-25 17:18 - 00002968 _____ () C:\Windows\System32\Tasks\{DD320EEE-AF76-4BFF-9D8D-74DC586C3DF7}
2015-01-25 17:18 - 2015-01-25 17:18 - 00002968 _____ () C:\Windows\System32\Tasks\{C33E7806-3940-49AA-8E3F-87407B744D48}
2015-01-25 17:18 - 2015-01-25 17:18 - 00002968 _____ () C:\Windows\System32\Tasks\{B9D28C67-CAD9-4A65-B954-43DC5FAC9147}
2015-01-25 17:18 - 2015-01-25 17:18 - 00002968 _____ () C:\Windows\System32\Tasks\{2F42AD4C-B626-4A7B-BE8D-879382CACDFE}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{F71D7E21-31D2-4B75-9F2E-D1023064785F}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{DC868B9F-18DC-4282-8982-CA04E365D8B4}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{C938709E-5132-4154-B7AB-F973F9AEB12D}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{C1EAF886-BE74-495C-BA01-3CF06D617CBB}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{C00AC9CA-31EE-4F7C-8178-F728318F37B2}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{9340A002-27AE-4F0D-B08F-CCCFAAB7051F}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{71D96554-704A-48CE-9AE8-294422BBB917}
2015-01-25 17:17 - 2015-01-25 17:17 - 00002968 _____ () C:\Windows\System32\Tasks\{31EE0835-121D-4F8E-8DE4-81E9C0E4CC9F}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{DEA50867-0680-4681-9E4B-DDBD590F88DC}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{DD0FB53D-835D-4328-B8E5-ABFF91CA4F30}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{D297B1C8-8193-42F0-A890-C51F2C993148}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{B9D2D592-B4A9-449B-AE00-33AA408E70F3}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{B356D192-DAE2-435A-9935-E4B7AE368AFA}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{8961765D-5A5E-40FC-88CD-914DE3F18C41}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{84D4F78B-4662-45BE-A52C-3FF4A2AA5AFF}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{682D6DFA-A37E-4AEB-AB81-2E58B5100B50}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{64387400-64B7-479B-9A6D-3CDD4F803E1A}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{5EB9BB05-C745-41E9-95C1-CB75157EA92E}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{42D40418-1777-430C-A14A-08FF26725ED6}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{3DD2E574-6D05-42A5-9385-0BEB8B104392}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{2A9D3EF4-287A-496B-BA54-0FD2282AF7DF}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{1A658748-DFD0-4454-8A74-FD77CEF65638}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{126A1D60-6B08-46F6-A797-96199ECE5EDC}
2015-01-25 17:16 - 2015-01-25 17:16 - 00002968 _____ () C:\Windows\System32\Tasks\{031F14CA-F08F-47ED-9554-64DADA0C8DE6}
2015-01-25 17:15 - 2015-01-25 17:15 - 00002968 _____ () C:\Windows\System32\Tasks\{943F9431-0485-4B44-AA6D-0D739E2EEE37}
2015-01-20 13:31 - 2015-01-20 13:31 - 00001439 _____ () C:\Users\PeterLustig\Desktop\Internet Explorer.lnk
2015-01-20 13:15 - 2015-01-20 13:15 - 00002968 _____ () C:\Windows\System32\Tasks\{4F2FD83F-AE71-4CA7-BC7B-E961F336D9FA}
2015-01-20 13:15 - 2015-01-20 13:15 - 00002968 _____ () C:\Windows\System32\Tasks\{29002138-A429-4FAD-85F0-612C27EAE1BF}
2015-01-20 13:13 - 2015-01-20 13:13 - 01118208 _____ (Farbar) C:\Users\PeterLustig\Desktop\FRST.exe
2015-01-20 13:12 - 2015-01-28 19:08 - 02130432 _____ (Farbar) C:\Users\PeterLustig\Desktop\FRST64.exe
2015-01-20 12:17 - 2015-01-25 22:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Metin2
2015-01-20 00:12 - 2015-01-25 22:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
2015-01-19 21:25 - 2015-01-19 21:25 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Gameforge4d
2015-01-09 15:49 - 2015-01-09 15:49 - 00000000 ____D () C:\Qoobox
2015-01-09 14:10 - 2015-01-09 17:35 - 00000000 ____D () C:\Windows\erdnt
2015-01-09 13:58 - 2015-01-09 13:58 - 02617176 _____ (VS Revo Group Ltd.) C:\Users\PeterLustig\Desktop\revosetup.exe
2015-01-09 13:58 - 2015-01-09 13:58 - 00001264 _____ () C:\Users\PeterLustig\Desktop\Revo Uninstaller.lnk
2015-01-09 13:58 - 2015-01-09 13:58 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-05 20:00 - 2015-01-28 18:49 - 00001654 _____ () C:\Users\PeterLustig\Desktop\Rkill.txt
2015-01-05 19:40 - 2015-01-27 15:02 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-05 19:40 - 2015-01-27 11:45 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-05 19:40 - 2015-01-05 19:48 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-05 19:40 - 2015-01-05 19:40 - 00004116 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-05 19:40 - 2015-01-05 19:40 - 00003864 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-05 19:40 - 2015-01-05 19:40 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Google
2015-01-05 19:36 - 2015-01-05 19:48 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Deployment
2015-01-05 19:36 - 2015-01-05 19:36 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Apps\2.0

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 19:10 - 2009-07-14 06:08 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-28 18:47 - 2011-10-15 14:33 - 01609711 _____ () C:\Windows\WindowsUpdate.log
2015-01-28 15:41 - 2009-07-14 05:45 - 00016624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-28 15:41 - 2009-07-14 05:45 - 00016624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-27 15:41 - 2014-04-14 11:49 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\Smartbar
2015-01-27 15:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-27 14:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At30.job
2015-01-27 14:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At29.job
2015-01-27 14:47 - 2011-11-14 17:11 - 00000000 ____D () C:\Users\PeterLustig\AppData\Local\LogMeIn Hamachi
2015-01-27 11:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At24.job
2015-01-27 11:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At23.job
2015-01-27 10:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At22.job
2015-01-27 10:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At21.job
2015-01-27 09:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At20.job
2015-01-27 09:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At19.job
2015-01-27 08:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At18.job
2015-01-27 08:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At17.job
2015-01-27 07:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At16.job
2015-01-27 07:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At15.job
2015-01-27 06:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At14.job
2015-01-27 06:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At13.job
2015-01-27 05:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At12.job
2015-01-27 05:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At11.job
2015-01-27 04:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At10.job
2015-01-27 04:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At9.job
2015-01-27 03:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At8.job
2015-01-27 03:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At7.job
2015-01-27 02:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At6.job
2015-01-27 02:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At5.job
2015-01-27 01:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At4.job
2015-01-27 01:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At3.job
2015-01-27 00:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At2.job
2015-01-26 23:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At48.job
2015-01-26 23:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At47.job
2015-01-26 22:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At46.job
2015-01-26 22:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At45.job
2015-01-26 21:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At44.job
2015-01-26 21:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At43.job
2015-01-26 20:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At42.job
2015-01-26 20:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At41.job
2015-01-26 19:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At40.job
2015-01-26 19:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At39.job
2015-01-26 18:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At38.job
2015-01-26 18:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At37.job
2015-01-26 17:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At36.job
2015-01-26 17:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At35.job
2015-01-26 16:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At34.job
2015-01-26 16:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At33.job
2015-01-26 15:56 - 2012-04-02 14:01 - 00000350 _____ () C:\Windows\Tasks\At32.job
2015-01-26 15:56 - 2012-04-02 14:01 - 00000348 _____ () C:\Windows\Tasks\At31.job
2015-01-26 13:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At28.job
2015-01-26 13:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At27.job
2015-01-26 12:56 - 2012-04-02 14:00 - 00000350 _____ () C:\Windows\Tasks\At26.job
2015-01-26 12:56 - 2012-04-02 14:00 - 00000348 _____ () C:\Windows\Tasks\At25.job
2015-01-25 22:22 - 2014-04-14 12:21 - 00000000 ____D () C:\Users\PeterLustig\AppData\Roaming\DAEMON Tools Lite
2015-01-25 22:22 - 2014-04-14 12:20 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2015-01-25 22:14 - 2013-01-05 16:46 - 00000000 ____D () C:\Users\PeterLustig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerStars.NET
2015-01-14 23:07 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-09 14:15 - 2011-12-09 16:19 - 00000000 ____D () C:\Users\PeterLustig\AppData\Roaming\DVDVideoSoft

==================== Files in the root of some directories =======

2012-07-12 12:46 - 2012-08-15 15:39 - 0000154 _____ () C:\Users\PeterLustig\AppData\Roaming\Rim.Desktop.Exception.log
2012-07-12 12:43 - 2012-07-12 12:44 - 0001847 _____ () C:\Users\PeterLustig\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2012-07-12 12:46 - 2012-07-12 19:54 - 0000077 _____ () C:\Users\PeterLustig\AppData\Roaming\Rim.DesktopHelper.Exception.log

Files to move or delete:
====================
C:\Windows\Tasks\At10.job
C:\Windows\Tasks\At11.job
C:\Windows\Tasks\At12.job
C:\Windows\Tasks\At13.job
C:\Windows\Tasks\At14.job
C:\Windows\Tasks\At15.job
C:\Windows\Tasks\At16.job
C:\Windows\Tasks\At17.job
C:\Windows\Tasks\At18.job
C:\Windows\Tasks\At19.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At20.job
C:\Windows\Tasks\At21.job
C:\Windows\Tasks\At22.job
C:\Windows\Tasks\At23.job
C:\Windows\Tasks\At24.job
C:\Windows\Tasks\At25.job
C:\Windows\Tasks\At26.job
C:\Windows\Tasks\At27.job
C:\Windows\Tasks\At28.job
C:\Windows\Tasks\At29.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At30.job
C:\Windows\Tasks\At31.job
C:\Windows\Tasks\At32.job
C:\Windows\Tasks\At33.job
C:\Windows\Tasks\At34.job
C:\Windows\Tasks\At35.job
C:\Windows\Tasks\At36.job
C:\Windows\Tasks\At37.job
C:\Windows\Tasks\At38.job
C:\Windows\Tasks\At39.job
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At40.job
C:\Windows\Tasks\At41.job
C:\Windows\Tasks\At42.job
C:\Windows\Tasks\At43.job
C:\Windows\Tasks\At44.job
C:\Windows\Tasks\At45.job
C:\Windows\Tasks\At46.job
C:\Windows\Tasks\At47.job
C:\Windows\Tasks\At48.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job
C:\Windows\Tasks\At9.job


Some content of TEMP:
====================
C:\Users\PeterLustig\AppData\Local\Temp\EAInstall.dll
C:\Users\PeterLustig\AppData\Local\Temp\eauninstall.exe
C:\Users\PeterLustig\AppData\Local\Temp\Madden NFL 08_uninst.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-01-06 22:48

==================== End Of Log ============================

--- --- ---

Und addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by PeterLustig at 2015-01-28 19:14:34
Running from C:\Users\PeterLustig\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.2.202.228 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.)
Apple Mobile Device Support (HKLM\...\{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}) (Version: 5.2.0.6 - Apple Inc.)
BlackBerry Desktop Software 6.1 (HKLM-x32\...\BlackBerry_Desktop) (Version: 6.1.0.33 - Research in Motion Ltd.)
BlackBerry Desktop Software 6.1 (x32 Version: 6.1.0.33 - Research in Motion Ltd.) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.17 - Piriform)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Fragen-Lern-CD 4.1 (HKLM-x32\...\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1) (Version: 4.1.0 - Wendel-Verlag GmbH)
Fragen-Lern-CD 4.1 (x32 Version: 4.1.0 - Wendel-Verlag GmbH) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2413 - Intel Corporation)
Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216029FF}) (Version: 6.0.290 - Oracle)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.1.0.210 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.1.0.210 - LogMeIn, Inc.) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.6361.0 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.6361.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.12 - ProtectDisc Software GmbH)
Revo Uninstaller 1.93 (HKLM-x32\...\Revo Uninstaller) (Version: 1.93 - VS Revo Group)
Sharepod 4.0.1.1 (HKLM-x32\...\{085BCFB8-F6FB-4600-AFAB-1F6DBC7F5F99}_is1) (Version:  - Macroplant LLC)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
System Requirements Lab for Intel (HKLM-x32\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
WinRAR 5.10 beta 2 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.10.2 - win.rar GmbH)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-01-09 17:35 - 2015-01-14 23:06 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {023CD47E-D530-4FC7-9E63-D52218A94836} - System32\Tasks\At27 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {038512EA-790D-4E62-9CA5-71832688CC9E} - System32\Tasks\At34 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {08A060D2-79C5-493C-BB58-F25C6BA42274} - System32\Tasks\At16 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {08A9CDCF-140F-4946-A22B-E96942BE57D2} - System32\Tasks\At23 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {092A2CCD-B7FB-4D8A-A6F3-39B558281AD1} - System32\Tasks\{DEA50867-0680-4681-9E4B-DDBD590F88DC} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {0EBCB69F-9D95-4F02-8874-8B54A76C1BF9} - System32\Tasks\At28 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {137D48DA-1BC0-4149-A96E-C102527095E9} - System32\Tasks\{D297B1C8-8193-42F0-A890-C51F2C993148} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {2250FD76-06B7-4D19-8C28-5B0474A7E0DD} - System32\Tasks\At41 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {2654B784-7444-41F1-BF3F-1BC233FC06F5} - System32\Tasks\{DD0FB53D-835D-4328-B8E5-ABFF91CA4F30} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {27C900CA-85F1-4FF4-BF0E-0F224CDCEE5A} - System32\Tasks\At31 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {2C29C7F1-6097-4608-A6F9-87E51D806769} - System32\Tasks\{1A658748-DFD0-4454-8A74-FD77CEF65638} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {2E82F8AA-E085-4430-A9BB-E07E6770A077} - System32\Tasks\At43 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {31B133A7-6BF9-4DBC-AB99-6B8925F5678E} - System32\Tasks\At19 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {31E98F7C-57A5-44C6-BDD5-2295CE741066} - System32\Tasks\At11 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {32981A40-3338-4708-A540-DC98ECAC45D5} - System32\Tasks\{682D6DFA-A37E-4AEB-AB81-2E58B5100B50} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {33159D5B-9ECB-4DEF-BF5F-FD99952ED4C1} - System32\Tasks\{71D96554-704A-48CE-9AE8-294422BBB917} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {3477C9F5-3974-4A35-990C-FCB292758A79} - System32\Tasks\{9340A002-27AE-4F0D-B08F-CCCFAAB7051F} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {350F53CD-ADA8-4289-9715-23C384F9F160} - System32\Tasks\{29002138-A429-4FAD-85F0-612C27EAE1BF} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {38DEB75D-FE90-436B-B3D2-1E1D0CE93165} - System32\Tasks\{42D40418-1777-430C-A14A-08FF26725ED6} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {4078CE44-2A79-4173-A0A8-0EF2F3727E8E} - System32\Tasks\At39 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {4287194E-8E3C-4B92-85DA-262E7B651873} - System32\Tasks\At25 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {472C7580-D297-44A5-8EE3-43D947010E8F} - System32\Tasks\At46 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {481CA121-F260-48A8-AB9F-8207906D6669} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02] (Adobe Systems Incorporated)
Task: {4D32C843-60B5-4524-928D-C6046D3D086B} - System32\Tasks\{050359C3-9664-4B7F-981F-22EB0E99C906} => D:\Modern Warfare 2\iw4sp.exe [2009-11-10] ()
Task: {509EFCB0-06DF-405A-B8D9-BE8252DA49B9} - System32\Tasks\At18 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {5369728C-FA0A-4D9B-9A4D-898B7C8E8465} - System32\Tasks\At3 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {53DC4EDD-B197-47BE-9D1A-F41F01A80888} - System32\Tasks\At1 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {5457AB80-34BF-42D3-87A8-2B3D00DC132B} - System32\Tasks\At22 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {569F5BA8-93C1-49AD-B818-C2CB24760FA7} - System32\Tasks\{7E3D0B0F-9677-418A-ABB0-411EAF0FB4AB} => D:\Modern Warfare 2\iw4sp.exe [2009-11-10] ()
Task: {599793EA-CD10-48C5-8721-98EE9D23E16A} - System32\Tasks\At8 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {5E38C7E8-E2C0-4D69-B413-4B736CD92CCC} - System32\Tasks\At9 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {62924DAD-B30D-429A-ADB2-E506CB9C60DA} - System32\Tasks\At29 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {6753B9B6-7291-4A5B-B8DB-E7B1BAAEEDD9} - System32\Tasks\At7 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {6AE4F13F-1B3E-4DC9-858E-7F2AF56990DB} - System32\Tasks\{9E93E75A-8F35-42AC-BB63-FB012FA62CC3} => pcalua.exe -a "D:\Minecraft\Minecraft 1.7.9.exe" -d D:\Minecraft
Task: {6BFB77DE-9F9A-4062-8E58-473F4DFCE9F3} - System32\Tasks\At35 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {71BA5A7F-5E29-4BEF-BF7E-53BD12347730} - System32\Tasks\At15 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {72A13C74-F5DD-4993-A479-FBD21EEEC63A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-05] (Google Inc.)
Task: {747F7FCF-BE57-4FDC-B413-A488420F74BF} - System32\Tasks\{2F42AD4C-B626-4A7B-BE8D-879382CACDFE} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {74909335-1F09-4813-9CB5-9F50961B6C50} - System32\Tasks\At33 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {76924028-4D82-4249-8BD8-625BD5A38EF1} - System32\Tasks\{C33E7806-3940-49AA-8E3F-87407B744D48} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {7CA94881-905C-45E0-ADEB-A8E81F696460} - System32\Tasks\{5EB9BB05-C745-41E9-95C1-CB75157EA92E} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {7DFA7A51-CB8E-4C09-A88E-5075F41AE38A} - System32\Tasks\At10 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {7FEE53C9-2AC5-4715-A32B-7E7BE3735F8F} - System32\Tasks\At12 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {84A36B6D-BC31-4537-9D75-27B29083F216} - System32\Tasks\{8961765D-5A5E-40FC-88CD-914DE3F18C41} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {855EC2F5-2255-4EE3-8531-F915AEB0DE37} - System32\Tasks\At13 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {86FB8A2D-979F-40C8-93EF-45597ED0C405} - System32\Tasks\{84D4F78B-4662-45BE-A52C-3FF4A2AA5AFF} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {8703EFC1-6D0E-4723-9258-093671AC0128} - System32\Tasks\At26 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {888ED9C2-7590-4DA1-81C7-671F71B1C538} - System32\Tasks\At17 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {89955AE0-5426-442E-9F25-CE20C3CF8A77} - System32\Tasks\At38 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {8A6771B0-E7B7-4A6E-8003-1B642A68BEAB} - System32\Tasks\{64387400-64B7-479B-9A6D-3CDD4F803E1A} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {8ACA9CF1-0768-48CC-971B-C575C76E4FA2} - System32\Tasks\{C938709E-5132-4154-B7AB-F973F9AEB12D} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {8B07AD0D-A2B0-4003-8F80-911107E3290D} - System32\Tasks\{031F14CA-F08F-47ED-9554-64DADA0C8DE6} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {8CF78935-894E-4F5D-A78C-2C60985396D1} - System32\Tasks\{C1EAF886-BE74-495C-BA01-3CF06D617CBB} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {8F366998-5120-47A1-B751-07B0D0453A53} - System32\Tasks\At24 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {92594A5A-4902-434C-A5AA-066C56B41430} - System32\Tasks\{B9D2D592-B4A9-449B-AE00-33AA408E70F3} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {92D5906E-6D2E-4935-95B2-9030563C4832} - System32\Tasks\At44 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {94F8A3A4-E096-402F-914D-84C77235BABE} - System32\Tasks\At45 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {9E0C44A3-F6B6-47CD-9733-A3521CF30278} - System32\Tasks\At20 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {9F3BF4A9-8335-475D-AD41-A62C5169283D} - System32\Tasks\{DC868B9F-18DC-4282-8982-CA04E365D8B4} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {A1338183-DA0E-493E-ABE4-9B7E7D35B232} - System32\Tasks\{966132B3-2041-49F5-957E-2D3FF4AFE000} => pcalua.exe -a C:\Mathe\Geogebra\GeoGebra.exe -d C:\Mathe\Geogebra
Task: {A28897FC-CAAE-458A-B1B3-8D2633A0C71A} - System32\Tasks\{DD320EEE-AF76-4BFF-9D8D-74DC586C3DF7} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {A5123B24-8588-4FE5-9563-6369B56330D3} - System32\Tasks\{B356D192-DAE2-435A-9935-E4B7AE368AFA} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {A770A8E0-BF77-471E-A909-7B38FCA68351} - System32\Tasks\At5 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {A87E06E5-FD8F-4074-B5B8-8D3317F4B095} - System32\Tasks\At4 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {AD5DD74D-2807-4D4B-8070-44BA7CD3B177} - System32\Tasks\At37 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {B0B9403C-2698-4423-AC14-A5278F2F582D} - System32\Tasks\At14 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {B733B431-E348-4B31-90FB-67C560102E4C} - System32\Tasks\At6 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {B8FD8E72-7549-4E6F-8A73-B75F8F31EF25} - System32\Tasks\{126A1D60-6B08-46F6-A797-96199ECE5EDC} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {BF53F786-18A4-44C7-ABA0-8F4D67BD05FF} - System32\Tasks\At2 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {C39A241F-7AA3-4C1C-B50F-FCFB1AC29A2B} - System32\Tasks\At40 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {C55919B0-0C58-452F-B2E8-3B7875AA23EA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-05] (Google Inc.)
Task: {C733C00A-8255-46E1-BA6B-4C3B8AE8D964} - System32\Tasks\{31EE0835-121D-4F8E-8DE4-81E9C0E4CC9F} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {C8B3DBE1-B577-4E80-BA3D-0B63C7CEEFA7} - System32\Tasks\At32 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {C9AD5789-D2EB-4430-AE2B-30C32CFDF915} - System32\Tasks\{943F9431-0485-4B44-AA6D-0D739E2EEE37} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {C9E77C31-3B2C-4C80-8007-BF9F5BF919FF} - System32\Tasks\At48 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {CD74D547-9794-4629-8A3D-F36B6D507BB0} - System32\Tasks\{4F2FD83F-AE71-4CA7-BC7B-E961F336D9FA} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {CF1FEFCC-5EBC-4306-BE09-0FEA2DBA812A} - System32\Tasks\At30 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {D32C0199-BB1E-4A51-ABF3-D191B204C73E} - System32\Tasks\{2A9D3EF4-287A-496B-BA54-0FD2282AF7DF} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {D3C0EEF8-371C-4804-BC98-0EC69D0B5F9D} - System32\Tasks\At42 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {E4C73F13-5D9C-4CBF-B9BD-4243F3568776} - System32\Tasks\At47 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {E4E70D88-095F-4A38-920F-E76EAEAE7F0E} - System32\Tasks\At21 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: {E64C74B0-1E24-4501-A363-2E8553BA9CA7} - System32\Tasks\{B9D28C67-CAD9-4A65-B954-43DC5FAC9147} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {EEDC5F86-7AA7-4C96-B9C7-6006BC65EBD1} - System32\Tasks\{3DD2E574-6D05-42A5-9385-0BEB8B104392} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {EF59E8A0-A43D-44FD-AF27-F1C76D8E32D4} - System32\Tasks\{F71D7E21-31D2-4B75-9F2E-D1023064785F} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {F75BBF04-CD42-4933-9A70-9B62F6722B73} - System32\Tasks\{C00AC9CA-31EE-4F7C-8178-F728318F37B2} => C:\Users\PeterLustig\Desktop\FRST64.exe [2015-01-28] (Farbar)
Task: {FF26CF92-C490-457D-B019-EC9DB864B1D1} - System32\Tasks\At36 => C:\Windows\Fonts\aXG0Q5j0.com <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\At10.job => ?
Task: C:\Windows\Tasks\At11.job => ?
Task: C:\Windows\Tasks\At12.job => ?
Task: C:\Windows\Tasks\At13.job => ?
Task: C:\Windows\Tasks\At14.job => ?
Task: C:\Windows\Tasks\At15.job => ?
Task: C:\Windows\Tasks\At16.job => ?
Task: C:\Windows\Tasks\At17.job => ?
Task: C:\Windows\Tasks\At18.job => ?
Task: C:\Windows\Tasks\At19.job => ?
Task: C:\Windows\Tasks\At2.job => ?
Task: C:\Windows\Tasks\At20.job => ?
Task: C:\Windows\Tasks\At21.job => ?
Task: C:\Windows\Tasks\At22.job => ?
Task: C:\Windows\Tasks\At23.job => ?
Task: C:\Windows\Tasks\At24.job => ?
Task: C:\Windows\Tasks\At25.job => ?
Task: C:\Windows\Tasks\At26.job => ?
Task: C:\Windows\Tasks\At27.job => ?
Task: C:\Windows\Tasks\At28.job => ?
Task: C:\Windows\Tasks\At29.job => ?
Task: C:\Windows\Tasks\At3.job => ?
Task: C:\Windows\Tasks\At30.job => ?
Task: C:\Windows\Tasks\At31.job => ?
Task: C:\Windows\Tasks\At32.job => ?
Task: C:\Windows\Tasks\At33.job => ?
Task: C:\Windows\Tasks\At34.job => ?
Task: C:\Windows\Tasks\At35.job => ?
Task: C:\Windows\Tasks\At36.job => ?
Task: C:\Windows\Tasks\At37.job => ?
Task: C:\Windows\Tasks\At38.job => ?
Task: C:\Windows\Tasks\At39.job => ?
Task: C:\Windows\Tasks\At4.job => ?
Task: C:\Windows\Tasks\At40.job => ?
Task: C:\Windows\Tasks\At41.job => ?
Task: C:\Windows\Tasks\At42.job => ?
Task: C:\Windows\Tasks\At43.job => ?
Task: C:\Windows\Tasks\At44.job => ?
Task: C:\Windows\Tasks\At45.job => ?
Task: C:\Windows\Tasks\At46.job => ?
Task: C:\Windows\Tasks\At47.job => ?
Task: C:\Windows\Tasks\At48.job => ?
Task: C:\Windows\Tasks\At5.job => ?
Task: C:\Windows\Tasks\At6.job => ?
Task: C:\Windows\Tasks\At7.job => ?
Task: C:\Windows\Tasks\At8.job => ?
Task: C:\Windows\Tasks\At9.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-03-25 07:54 - 2014-03-25 07:54 - 00148248 _____ () C:\Users\PeterLustig\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\PeterLustig\AppData\Local\Smartbar\Application\Smartbar.exe startup
MSCONFIG\startupreg: facemoods => "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RIMBBLaunchAgent.exe => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-1814202685-1767394472-907846378-500 - Administrator - Disabled)
Gast (S-1-5-21-1814202685-1767394472-907846378-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1814202685-1767394472-907846378-1004 - Limited - Enabled)
PeterLustig (S-1-5-21-1814202685-1767394472-907846378-1001 - Administrator - Enabled) => C:\Users\PeterLustig

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Massenspeichercontroller
Description: Massenspeichercontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: O2Micro SmartCardBus_Reader
Description: O2Micro SmartCardBus_Reader
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/28/2015 07:14:24 PM) (Source: ESENT) (EventID: 488) (User: )
Description: wuaueng.dll (816) SUS20ClientDataStore: Versuch, Datei "C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb" zu erstellen, ist mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) beim Erstellen von Dateien.

Error: (01/28/2015 07:13:59 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <1, 0x80070003, Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\>.

Error: (01/28/2015 07:13:59 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.


Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:12:21 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <1, 0x80070003, Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\>.

Error: (01/28/2015 07:12:21 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.


Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:12:01 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <1, 0x80070003, Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\>.

Error: (01/28/2015 07:12:01 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.


Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:12:00 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <1, 0x80070003, Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\>.

Error: (01/28/2015 07:12:00 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.


Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:11:30 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <1, 0x80070003, Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\>.


System errors:
=============
Error: (01/28/2015 07:14:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 6 Mal passiert.

Error: (01/28/2015 07:14:00 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem Fehler beendet: 
%%3

Error: (01/28/2015 07:12:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 5 Mal passiert.

Error: (01/28/2015 07:12:22 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem Fehler beendet: 
%%3

Error: (01/28/2015 07:12:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.

Error: (01/28/2015 07:12:02 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem Fehler beendet: 
%%3

Error: (01/28/2015 07:12:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.

Error: (01/28/2015 07:12:00 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem Fehler beendet: 
%%3

Error: (01/28/2015 07:11:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/28/2015 07:11:31 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem Fehler beendet: 
%%3


Microsoft Office Sessions:
=========================
Error: (01/28/2015 07:14:24 PM) (Source: ESENT) (EventID: 488) (User: )
Description: wuaueng.dll816SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.

Error: (01/28/2015 07:13:59 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 10x80070003Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\

Error: (01/28/2015 07:13:59 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: 
Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:12:21 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 10x80070003Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\

Error: (01/28/2015 07:12:21 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: 
Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:12:01 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 10x80070003Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\

Error: (01/28/2015 07:12:01 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: 
Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:12:00 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 10x80070003Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\

Error: (01/28/2015 07:12:00 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: 
Details:
	Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben.  (HRESULT : 0x80070660) (0x80070660)

Error: (01/28/2015 07:11:30 PM) (Source: Windows Search Service) (EventID: 1006) (User: )
Description: 10x80070003Fehler beim Erstellen des Anwendungsverzeichnisses: C:\ProgramData\Microsoft\Search\Data\Applications\


CodeIntegrity Errors:
===================================
  Date: 2015-01-09 17:33:29.362
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-09 17:33:29.315
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 69%
Total physical RAM: 961.88 MB
Available physical RAM: 291.84 MB
Total Pagefile: 1985.88 MB
Available Pagefile: 1145.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:29.29 GB) (Free:0 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:82.49 GB) (Free:52.46 GB) NTFS
Drive f: (GE_108887) (CDROM) (Total:6.97 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 16CCAF43)
Partition 1: (Active) - (Size=29.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=8 MB) - (Type=45)
Partition 3: (Not Active) - (Size=82.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

20.01.2015, 12:04	#8
schrauber /// the machine /// TB-Ausbilder	Win7 Ultimtate 64bit; nach Bundespolizei-Virus; kein Rechtsklick; nichts installierbar; Speicher auf Festplatte immer voll Beende Combofix, und poste bitte ein frisches FRST log __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

20.01.2015, 18:02	#10
schrauber /// the machine /// TB-Ausbilder	Win7 Ultimtate 64bit; nach Bundespolizei-Virus; kein Rechtsklick; nichts installierbar; Speicher auf Festplatte immer voll AV Programm abschalten, dann funzt auch FRST __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Win7 Ultimtate 64bit; nach Bundespolizei-Virus; kein Rechtsklick; nichts installierbar; Speicher auf Festplatte immer voll

Plagegeister aller Art und deren Bekämpfung: Win7 Ultimtate 64bit; nach Bundespolizei-Virus; kein Rechtsklick; nichts installierbar; Speicher auf Festplatte immer voll